Eric Murray <ericm @
MicroUnity .
com> wrote:
> Actually, it occurs that in this second scenario -- a confederate of the
> baddies, perhaps a disaffected employee inside your network -- even
> authentication of outbound connections wouldn't help you: if this
> insider is `trusted' -- allowed to make outbound connections through
> (say) your telnet application gateway -- then she can if so determined
> misuse this channel anyway (eg:
>
> connects out via your telnet application gateway to a port on a <---**
> collaborating remote system, which echoes back commands to be
> executed on your local system; user's local program -- either
> custom written, or `expect' wrapped around an ordinary telnet
> client(?) -- then acts accordingly, and echoes resulting output
> back down the line
... Well how about if the application gateway does not allow internal
users to "telnet to a port", but only allows telnet to the standard
remote telnet port? ...
--
Bill Heiser heiser @
world .
std .
com
Follow-Ups:
|
|
